[26904] in bugtraq
Re: Compaq mount patch broken
daemon@ATHENA.MIT.EDU (Florian Weimer)
Tue Sep 3 17:03:31 2002
To: psz@maths.usyd.edu.au (Paul Szabo)
From: Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>
Date: Tue, 03 Sep 2002 20:44:47 +0200
In-Reply-To: <200209030318.g833In814683@milan.maths.usyd.edu.au> (psz@maths.usyd.edu.au's
message of "Tue, 3 Sep 2002 13:18:49 +1000 (EST)")
Message-ID: <87wuq2q5eo.fsf@Login.CERT.Uni-Stuttgart.DE>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
psz@maths.usyd.edu.au (Paul Szabo) writes:
> I have reported this to Compaq (but expect no speedy resolution). I am
> puzzled: why patch /sbin/mount or /usr/bin/csh if they are not setuid?
Paul confirmed in private email that /sbin/mount is statically linked.
I guess that it contains a copy of the RPC code for NFS mounts.
xdr_array() is actually used for interaction with rpc.mountd, so a new
/sbin/mount binary was needed to remove a potential threat.
(I haven't got access to a Tru64 system, so this is pure, albeit
plausible speculation.)
--
Florian Weimer Weimer@CERT.Uni-Stuttgart.DE
University of Stuttgart http://CERT.Uni-Stuttgart.DE/people/fw/
RUS-CERT fax +49-711-685-5898
